Event Grid topics should have an identity provider enabled
Ensure that managed identity provider is enabled for the Event Grid Topic. This control is non-compliant if Event Grid topic identity provider is disabled. Checkov CKV_AZURE_191 targets `azurerm_eventgrid_topic`.
What this control checks
Event Grid topic must have a managed identity provider enabled
Common pitfalls
Only identity type None raises the alarm
The Powerpipe query reports 'alarm' when identity ->> 'type' = 'None'. Otherwise it reports 'ok'.
Checkov accepts any identity type value
The Checkov check inspects the key identity/[0]/type. It expects ANY_VALUE for that key.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.eventgrid_topic_identity_provider_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_191.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
eventgrid_topic_identity_provider_enabled - Checkov Check:
CKV_AZURE_191 - Powerpipe Control:
azure_compliance.control.eventgrid_topic_identity_provider_enabled
Last reviewed: 2026-10-11